Rogue external MFA providers can steal passwords during logins

Summary

Varonis Threat Labs demonstrated TrustSink, a post-compromise technique in which an attacker controlling a highly privileged Microsoft Entra account registers a rogue external MFA provider. The provider displays a fake Microsoft password prompt during MFA, captures passwords in plaintext, and returns a signed token that allows the login to complete normally.

Key points

• TrustSink requires prior control of a Global Administrator or Authentication Policy Administrator account; it is not an initial-access technique.
• The rogue External Authentication Method is registered through changes to the Authentication Methods Policy and creation of an application, service principal, and consent grant.
• During MFA, Entra redirects the user to the attacker-controlled provider, which can display a convincing copy of Microsoft's password prompt and capture the password entered by the victim.
• The malicious provider can return a valid signed token indicating MFA was completed, so the victim's login succeeds without an error.
• Varonis stated that, in its test tenant, captured passwords included timestamps and source IP addresses.
• Password resets alone do not remove the rogue provider; it can capture replacement passwords during subsequent sign-ins.
• Varonis recommends removing suspicious external MFA providers and associated applications, keys, and redirect URIs before rotating affected credentials, while monitoring Authentication Methods Policy changes and limiting privileged administrator access.

Tags

MITRE ATT&CK

Vendors

Products